vLLM Server-Side Request Forgery Vulnerability in MediaConnector Class

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the vLLM project's MediaConnector class, specifically within its multimodal feature set. The vulnerability arises because the load_from_url and load_from_url_async methods retrieve and process media from user-supplied URLs without sufficient restrictions on the target hosts. This flaw enables attackers to manipulate the vLLM server into making arbitrary requests to internal network resources.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal network resources, allowing attackers to bypass access controls and potentially conduct network reconnaissance. Additionally, it could cause a denial-of-service by disrupting internal services.

Remediation

Users are advised to update the affected package as soon as possible.